[java-idp-oidc] branch main updated: JOIDC-76 - Facilitate custom response header settings (e.g. CORS)
Henri Mikkonen
henri.mikkonen at iki.fi
Wed Mar 2 14:39:23 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=69e50dd0e3ecb4260dccf49ecc7539dbc06a4e52
The following commit(s) were added to refs/heads/main by this push:
new 69e50dd0 JOIDC-76 - Facilitate custom response header settings (e.g. CORS)
69e50dd0 is described below
commit 69e50dd0e3ecb4260dccf49ecc7539dbc06a4e52
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 2 16:37:22 2022 +0200
JOIDC-76 - Facilitate custom response header settings (e.g. CORS)
https://shibboleth.atlassian.net/browse/JOIDC-76
Initial version: ServletContextInitializer is used for dynamically registering
DynamicOidcResponseHeaderFilter, which refers to bean shibboleth.oidc.ResponseHeaderFilter
that can be used for configuring the custom headers for the /profile/oauth2/* and
/profile/oidc/* endpoints.
---
.../RegisterFilterServletContextInitializer.java | 59 ++++++++++++++++++++++
.../idp/plugin/oidc/op/servlet/package-info.java | 19 +++++++
.../META-INF/net.shibboleth.idp/postconfig.xml | 6 +++
.../javax.servlet.ServletContainerInitializer | 1 +
.../idp/plugin/oidc/op/conf/oidc.properties | 4 ++
5 files changed, 89 insertions(+)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/RegisterFilterServletContextInitializer.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/RegisterFilterServletContextInitializer.java
new file mode 100644
index 00000000..f9d8390e
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/RegisterFilterServletContextInitializer.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.servlet;
+
+import java.util.Set;
+
+import javax.annotation.Nonnull;
+import javax.servlet.FilterRegistration;
+import javax.servlet.ServletContainerInitializer;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.filter.DelegatingFilterProxy;
+
+/**
+ * A {@link ServletContainerInitializer} implementation that registers dynamic response header filter for enabling
+ * configurable headers. The target bean name is {@link RegisterFilterServletContextInitializer#TARGET_BEAN_NAME}.
+ */
+public class RegisterFilterServletContextInitializer implements ServletContainerInitializer {
+
+ /** The filter name for the dynamic response header filter for the OP's flows. */
+ public static final String FILTER_NAME_DYNAMIC_OIDC_RESPONSE_HEADER = "DynamicOidcResponseHeaderFilter";
+
+ /** The target bean name for the dynamic response header filter. */
+ public static final String TARGET_BEAN_NAME = "shibboleth.oidc.ResponseHeaderFilter";
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(RegisterFilterServletContextInitializer.class);
+
+ /** {@inheritDoc} */
+ @Override
+ public void onStartup(final Set<Class<?>> c, final ServletContext ctx) throws ServletException {
+ final FilterRegistration.Dynamic headerFilter = ctx.addFilter(FILTER_NAME_DYNAMIC_OIDC_RESPONSE_HEADER,
+ DelegatingFilterProxy.class);
+ headerFilter.addMappingForUrlPatterns(null, false, "/profile/oidc/*");
+ headerFilter.addMappingForUrlPatterns(null, false, "/profile/oauth2/*");
+ headerFilter.setInitParameter("targetBeanName", TARGET_BEAN_NAME);
+
+ log.info("Registered the filter '{}'.", FILTER_NAME_DYNAMIC_OIDC_RESPONSE_HEADER);
+
+ }
+}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/package-info.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/package-info.java
new file mode 100644
index 00000000..b836f701
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/servlet/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Classes extending/exploiting the Java Servlet API. */
+package net.shibboleth.idp.plugin.oidc.op.servlet;
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
index e3e2067b..01c825c6 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net.shibboleth.idp/postconfig.xml
@@ -280,4 +280,10 @@
</property>
</bean>
+ <alias name="%{idp.oidc.ResponseHeaderFilter:shibboleth.oidc.EmptyResponseHeaderFilter}"
+ alias="shibboleth.oidc.ResponseHeaderFilter" />
+
+ <bean id="shibboleth.oidc.EmptyResponseHeaderFilter"
+ class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter" />
+
</beans>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer b/idp-oidc-extension-impl/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
new file mode 100644
index 00000000..7614630a
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
@@ -0,0 +1 @@
+net.shibboleth.idp.plugin.oidc.op.servlet.RegisterFilterServletContextInitializer
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 58358f64..68540acb 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -89,6 +89,10 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
#idp.oidc.config.minRefreshDelay = PT5M
#idp.oidc.config.maxRefreshDelay = PT4H
+# Bean to configure additional response headers: none is added by default, but e.g. shibboleth.ResponseHeaderFilter
+# contains headers further configurable via other properties such as 'idp.hsts', 'idp.frameoptions' and 'idp.csp'.
+#idp.oidc.ResponseHeaderFilter = shibboleth.ResponseHeaderFilter
+
#
# OAuth2 Settings - these typically involve generic OAuth 2.0 use cases
#
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list